About this plugin
Boosted gives you fast WordPress pages with page caching, image optimization,
CSS/JS handling, an SEO and keyphrase panel, redirects, and a GDPR-style cookie
banner. Core performance, caching, image optimization, SEO, redirects, and
cookie consent features are available free, with optional Pro upgrades for
advanced optimization capabilities.
php
for you. If the file is not writable, the tab shows the one line to add by
hand.
External services
Boosted contacts the third-party services listed below. Every one of them is
reached only after you configure it or explicitly request its suggestions, so a fresh install with
nothing filled in contacts nothing at all. Each entry says what triggers the
request, exactly what is sent, and whether it happens in the WordPress admin or
during a visitor’s page load.
Datamuse related wording
com/words
When: only when an authorized editor clicks “Suggest related wording” in the
Boosted SEO Related Wording box on a post or page. No background queries.
What is sent: the phrase explicitly entered (2–100 characters), vocabulary
language (English or Spanish), and a result limit. Post content, titles,
descriptions, visitor data and WordPress credentials are not included.
Where: server-side from the editor. WordPress caches results per user for
15 minutes. Suggestions never change metadata automatically.
Datamuse temporarily logs queries; its documentation says logs are discarded
at the end of the following day. Suggestions are not search-volume data.
com/api/
Datamuse announces mandatory API keys from January 1, 2027. This integration
currently uses its keyless endpoint; authentication will need updating when
that requirement takes effect. Service failures leave core SEO unaffected.
YouTube video preview images
jpg
)
When: only once you switch on “Show YouTube and Vimeo videos as a preview
until played” on the Images screen, and only the first time a page with a
given YouTube video is built (again after the page cache is cleared). The
image is saved with Boosted’s cache and
served from your own site after that.
What is sent: the video id in the address. The request comes from your
server; nothing about the visitor whose page view triggered it is included.
Where: server-side. Visitors’ browsers do not contact YouTube until they
press play, at which point YouTube’s own player loads as it would without
Boosted.
com/privacy
com/t/terms
Gravatar avatars
com/avatar/HASH
(HASH is the hashed e-mail address WordPress already puts in every avatar
)
When: only once you switch on “Serve Gravatars from your site” on the Images
screen, and only when a page that shows an avatar is built and no copy of
that avatar younger than a week is on hand. The image is saved with Boosted’s
cache and served from your own site.
What is sent: the avatar address WordPress built, with its size and default
image. The request comes from your server; nothing about the visitor whose
page view triggered it is included.
Where: server-side. With this switched on, visitors’ browsers no longer
contact Gravatar for avatars.
com/privacy/
com/tos/
Google PageSpeed Insights API
com/pagespeedonline/v5/runPagespeed
When: only when an administrator runs a PageSpeed measurement, and only once you
have saved your own Google API key. With no key saved, no request is made.
What is sent: the public URL being tested, and your own API key.
Where: the WordPress admin only. Visitors never trigger this.
Google OAuth 2.0 – signing in for Analytics reporting
com/token
When: only once you have saved a GA4 Property ID and a Google service-account
key, and only when a page or widget actually uses the [boosted_ga total_views]
shortcode. Without either field, or without the shortcode on a page, no request
is made.
What is sent: a signed assertion (a JWT) proving the request comes from your own
service account. It is signed with the private key you saved; the key itself is
never sent.
Where: during a front-end page load, because that is when the shortcode renders.
No visitor data is included in the request, and the answer is cached for an hour
so a page showing the number does not sign in on every visit.
Google Analytics Data API
com/v1beta/properties/PROPERTY_ID:runReport
)
When: immediately after the sign-in above, and under the same conditions.
What is sent: your GA4 Property ID and a date range. Nothing about the visitor
whose page load happened to trigger it.
Where: during a front-end page load, as above. The answer is cached for an hour,
and a failure for fifteen minutes, so a broken setup does not retry on every
visit.
Google reCAPTCHA – verification
com/recaptcha/api/siteverify
When: when somebody submits a comment on your site, and only once you have saved
both a reCAPTCHA site key and a secret key. Administrators and other users who
can moderate comments are not verified.
What is sent: the reCAPTCHA response token from the visitor’s browser, your
secret key, and the visitor’s IP address.
Where: this one affects your site’s visitors, not just administrators. A visitor
who posts a comment has their IP address sent to Google. If you switch reCAPTCHA
on, say so in your own privacy policy.
Google reCAPTCHA – script
js
When: loaded in every visitor’s browser on pages with a comment form, once
reCAPTCHA is configured. Google sets its own cookies and collects its own data
from that point; Boosted is not party to it.
Where: your visitors’ browsers.
Google Tag Manager and Google Analytics (gtag)
com/gtag/js,
html
When: loaded in visitors’ browsers only once you have saved a GA4 Measurement ID
or a Google Tag Manager container ID. With neither saved, no script is added.
What is sent: whatever Google’s own script collects, which is Google’s to
describe rather than Boosted’s. Boosted adds the tag and nothing else.
Where: your visitors’ browsers.
For all of the Google services above:
com/privacy
com/terms
com/terms/
Freemius – licensing, opt-in usage tracking and update delivery
com
When: on activation WordPress shows the Freemius opt-in prompt. Only if you
opt in does the plugin contact Freemius: on activation/deactivation, on
licence activation or check, and on the scheduled update check.
What is sent: site URL, WordPress and PHP versions, plugin version, site
language, admin email address only if you opted in, and licence state when a
licence key is entered. No page content, no visitor data, no settings values,
no secrets.
Where: the WordPress admin only. Visitors never trigger this. You can opt out
at any time from the Freemius account menu; the plugin keeps working with
free behaviour.
com/privacy/
com/terms/
Cloudflare API – cache purge sync (Boosted Pro only)
com/client/v4/zones/{zone ID}/purge_cache
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Cloudflare Cache Synchronization and enter your own Cloudflare
zone ID and API token.
When: after Boosted clears pages from its own page cache – when a post is
published, updated or deleted, or when the whole cache is cleared.
What is sent: the URLs of the pages that were cleared (or a request to purge
the whole zone), and your Cloudflare API token as the authorization header. No
page content, no visitor data.
Where: from your server to Cloudflare. Visitors never trigger this.
com/privacypolicy/
com/terms/
AI provider through WordPress – SEO metadata drafts (Boosted Pro only)
This code is not in the free plugin. 0
or later, only after you switch on the AI Meta Description & Title Assistant and
connect an AI provider yourself under Settings > Connectors (for example
Anthropic, Google or OpenAI, each with its own WordPress plugin and your own API
key). Boosted does not contact any AI service itself and never holds an API key;
it asks WordPress’s built-in AI client, which sends the request to the provider
you connected.
When: when you generate drafts under SEO > Automation, up to 10 posts at a time.
What is sent: for each post, its ID, title, focus keyphrase and up to the first
1,500 characters of its text (without HTML, shortcodes or links), plus your site
name. No visitor data. The drafts that come back change nothing until you
approve them.
Where: from your server to the provider you connected. Its terms and privacy
policy are those of that provider.
Google Tag Manager – local copy of gtag.js (Boosted Pro only)
id={your measurement ID}
This code is not in the free plugin. It applies to Boosted Pro, and only after
you switch on Local Analytics Hosting while Boosted adds Google Analytics to your
site.
When: once a day, from WP-Cron.
What is sent: your Google Analytics measurement ID, to download the current
js. The file is stored in your uploads folder and served from your site in
place of Google’s copy. No visitor data is sent by the download.
Where: from your server to Google. What Google Analytics itself collects from
visitors is unchanged and is described under “Google Tag Manager and Google
Analytics (gtag)” above.
com/privacy
com/terms
What does not leave your site
Cache preloading and the cache self-test request your own pages, on your own
domain, and nowhere else.
Your PageSpeed API key, your reCAPTCHA secret and your Google service-account key
are stored on this site only. They are never shown back to you after saving and
are excluded from a settings export.
The Copy for AI button on Console Logs puts text on your clipboard for you to
paste somewhere yourself. It contains no keys, no settings values and no server
paths, and Boosted sends it nowhere.
External fonts and optional local copies
Free does not download external font stylesheets or font files on the server.
If an administrator enables font resource hints or CSS external preconnect,
Boosted may add a browser preconnect or DNS-prefetch hint for an external
stylesheet already enqueued by the theme or another plugin. This connects the
visitor’s browser to that host and can disclose the visitor’s IP address;
Boosted does not add the third-party stylesheet itself.
Premium can make server-side requests only after an administrator enables Font
Optimization and either Self-host Fonts or Optimize External Font CSS, then
runs a font rebuild. The rebuild examines external font stylesheets previously
found during site analysis. Only Google Fonts and Bunny Fonts stylesheets are
eligible; Boosted downloads those, and it copies
font files locally only when Self-host Fonts is enabled. The request sends the
full stylesheet or font-file URL (including its query), the site’s server IP,
and a browser-like User-Agent. It sends no WordPress credentials or visitor IP.
Cached copies are stored under wp-content/cache/boosted/fonts/.
com.
Premium may download and locally cache their openly licensed fonts after the
explicit settings and rebuild above. com/terms
com/privacy
net. Premium may download and locally cache
its openly licensed fonts after the same explicit settings and rebuild.
net/privacy/
net. com:
net. Boosted may recognize these existing external
stylesheets and may add a preconnect hint if that setting is enabled. Boosted
does not download or self-host their font files; the original provider or
theme remains responsible for serving them. Adobe’s standard web-font terms
prohibit self-hosting; Monotype fonts require the site’s own applicable
license and usage reporting. Adobe terms:
html
com/legal/terms-use
Monotype privacy:
com/legal/privacy-policy/website-use-privacy-policy
Any other external font or icon-font stylesheet (for example one a theme loads
from an icon CDN) is treated generically as an external stylesheet. Boosted
does not identify its provider, never requests it on the server and never
copies its files; at most it may add the browser preconnect hint described
above when the administrator enables that setting.
Boosted itself never enqueues a stylesheet or font file from any of the font
providers above. It only works with stylesheets the theme or another plugin
has already added to the page.
Source Code & Build Instructions
All script and style assets shipped in Boosted are provided in full human-readable format.
The uncompiled source files are included directly in the plugin package inside assets/src/:
- Tailwind CSS admin styles source: assets/src/tailwind.css
css
- Consent runtime source: assets/src/consent-runtime.js
js
- Admin script: assets/admin.js (written and maintained directly as plain, non-minified JavaScript)
- Minified admin copies: assets/admin.min.js and assets/tailwind.min.css are assets/admin.js and
css with comments and whitespace removed (JShrink for the script, matthiasmullie/minify
for the stylesheet). Both sources ship beside them, and WordPress loads the sources when SCRIPT_DEBUG is on.
- Freemius pricing bundle: vendor/freemius/freemius-sdk/assets/js/pricing/freemius-pricing.js
com/Freemius/pricing-page
Boosted-authored JavaScript is supplied in readable form. The bundled Freemius
pricing script is third-party compiled code; its upstream source is linked above.